[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHsHv-b8xnPYe4QL=CaypfoK3zLhLvatEbM941v5rZgV_bXDww@mail.gmail.com>
Date: Sun, 3 Nov 2019 00:11:03 +0100
From: "bryn1u85 ." <m.bryn1u@...il.com>
To: lkrg-users@...ts.openwall.com
Subject: Re: "SYSTEM HAS BEEN COMPROMISED" - false positive.
Kernel 5.3.7 Centos 7
Hey Adam,
Thanks for your help.
18.171127] OOM killer enabled.
[ 18.171128] Restarting tasks ... done.
[ 18.196220] [p_lkrg] Disabling "clean" message.
[ 18.290631] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 22.387093] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow
Control: None
[ 22.387464] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 25.485560] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 25.503701] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 25.513051] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 31.184558] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.322846] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.346990] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.524453] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.546939] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.728217] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.750910] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 46.944593] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 1669.160381] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
[ 1669.173841] [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core
.text section hash!
Seems to be working !
Adam, is there any way to talk with you about lkrg experimental via
freenode ?
Best regards,
Michał
sob., 2 lis 2019 o 05:56 Adam Zabrocki <pi3@....com.pl> napisał(a):
> Hi,
>
> I've pushed some significant changes to the official repo. Linux kernel
> 5.3+
> introduced new logic for JUMP_LABEL engine. New changes suppose to bring
> support for it, nevertheless I would still treat them as 'beta' so far.
> Please
> let me know in case of any problems.
>
> Thanks,
> Adam
>
> On Sun, Oct 27, 2019 at 03:31:48PM +0100, Adam Zabrocki wrote:
> > Hi,
> >
> > I will take a look on this soon. Sorry for delay.
> >
> > Best regards,
> > Adam
> >
> > On Thu, Oct 24, 2019 at 01:14:10PM +0200, bryn1u85 . wrote:
> > > Hey guys,
> > >
> > > After KRG installed and rebooted clear Centos 7 server with 5.3.7
> kernel,
> > > im getting flase positive message that my system has been compromised.
> > >
> > > [ 15.215179] [p_lkrg] Verifying 20 potential UMH paths for
> whitelisting...
> > > > [ 15.215440] [p_lkrg] 4 UMH paths were whitelisted...
> > > > [ 15.770986] [p_lkrg] [kretprobe] register_kretprobe() for
> > > > <ovl_create_or_link> failed! [err=-22]
> > > > [ 15.771146] [p_lkrg] ERROR: Can't hook ovl_create_or_link
> function :(
> > > > [ 16.101128] [p_lkrg] System does NOT support SMEP. LKRG can't
> enforece
> > > > smep_panic :(
> > > > [ 16.101291] [p_lkrg] LKRG initialized successfully!
> > > > [ 16.101388] OOM killer enabled.
> > > > [ 16.101389] Restarting tasks ... done.
> > > > [ 16.111918] [p_lkrg] Disabling "clean" message.
> > > > [ 16.505143] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 16.507699] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 20.284601] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 20.287154] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 20.467062] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex,
> Flow
> > > > Control: None
> > > > [ 20.467403] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes
> ready
> > > > [ 20.473798] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 20.476426] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 20.487083] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 20.489683] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 20.552752] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 20.557202] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 20.567645] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 20.570199] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 21.449073] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xd08e6ff0783c57b9] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 21.452966] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 22.757754] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 22.760538] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 23.427505] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 23.429955] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 23.452633] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 23.456172] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 23.467435] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 23.470119] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 23.480574] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 23.483170] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 23.520029] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 23.523148] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 23.949947] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 23.954075] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 24.709764] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 24.713784] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 25.314291] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 25.318615] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 27.216958] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 27.221325] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 31.553746] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 31.557484] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 46.916572] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 46.920946] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 46.938976] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 46.943298] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 61.849477] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 61.853839] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 77.210168] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 77.214487] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 92.570441] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 92.574755] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 107.930713] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 107.935054] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 123.291483] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 123.295817] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 138.651453] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 138.655770] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 144.437314] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 144.441864] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 154.012063] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 154.016381] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 169.372487] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 169.376807] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 184.733001] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 184.737362] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 200.093039] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 200.097373] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 215.453739] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 215.458065] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 230.809842] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 230.813139] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 246.174271] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 246.178591] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 261.534753] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 261.539121] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 276.895308] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 276.899637] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 292.256060] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 292.260376] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 307.616310] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 307.620630] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 322.976587] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 322.980904] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 338.337086] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 338.341404] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 344.481200] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 344.485567] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 353.697625] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 353.701967] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 369.057955] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 369.062276] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [ 369.079009] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS
> DIFFERENT -
> > > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > > [ 369.083003] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED -
> DETECTED
> > > > DIFFERENT 1 CHECKSUMS !!!
> > > > [root@...039183 ~]#
> > > >
> > >
> > > Someone can help ?
> > >
> > > Thanks !
> >
> > --
> > pi3 (pi3ki31ny) - pi3 (at) itsec pl
> > http://pi3.com.pl
> >
>
> --
> pi3 (pi3ki31ny) - pi3 (at) itsec pl
> http://pi3.com.pl
>
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
